@@ -188,6 +188,27 @@ Parent Process              Plugin Process
 7. **Reporter display methods are async**: All `Reporter` interface display methods (`displayPlan`, `displayImportResult`, `displayFileModifications`, `displayMessage`, `displayPluginError`) return `Promise<void>`. Always `await` them at call sites — `DefaultReporter.updateRenderState()` has a 50ms sleep, so unawaited calls cause `process.exit(1)` to fire before the UI renders.
 8. **Mock reporter async assertions**: Assertions inside `MockReporter` config callbacks (e.g. `displayFileModifications`) will silently pass if the call isn't awaited. Making display methods async surfaced latent bugs where expected file paths were wrong.
 
+## Template Resource Architecture
+
+`{ "type": "template", "source": "nvm" | "@profile/name" | "<dashboard document uuid>" }` is a core config block (like `project`). It lives in the CLI, is never sent to a plugin, and is replaced by the resources of the template.
+
+**Flow** (only for `plan`, `apply` and `destroy`: `PluginInitOrchestrator` with `expandTemplates: true`):
+```
+Parse → TemplateExpander.expand() → PluginManager.initialize() → os/distro filters
+      → TemplateResourceMerger.merge() → validate → resolve dependencies
+      → TemplateCommandApproval.ensureApproved() → plan → apply
+```
+
+- **`src/entities/template-config.ts`**: `TemplateConfig` (`ConfigType.TEMPLATE`), validated against `TemplateSchema` from `@codifycli/schemas`. `Project.templateConfigs` holds the declarations and `Project.declarations` keeps the declaration order.
+- **`src/templates/template-loader.ts`**: `ApiTemplateLoader` loads registry templates (`DashboardApiClient.getTemplate`, no login) or dashboard documents (uuid, login required). `version` is in the schema but not supported by the registry yet (throws). Local files are intentionally not supported.
+- **`src/templates/template-expander.ts`**: expands templates recursively, in place. Templates can't declare plugins. Each resource records `origins` (the template chains it was included through). Cycles are skipped; a template included twice is added once and gains an extra origin.
+- **Template constraints**: `dependsOn` on a template declaration is stored in `ResourceConfig.inheritedDependsOn` (never written to files or sent to plugins). `os`/`distro` on a template are applied through `origins` in the Project filters. `dependsOn: ["template.<name>"]` / `"template"` / `"<name>"` resolve to the resources of that template.
+- **`src/templates/template-resource-merger.ts`**: after plugin init, template resources that the owning plugin `match`es with an earlier resource are merged into it (project resources win, then earlier templates). Arrays are combined, objects merged, scalar conflicts keep the winner and become `Plan.warnings`. Unmatched unnamed duplicates get numeric names in declaration order.
+- **Ordering**: `DependencyGraphResolver` is a stable Kahn sort (declaration order unless a dependency requires a move), so template resources stay at the template's position.
+- **`src/templates/template-command-approval.ts`**: `action` resources only declared in templates must be approved before planning (the `condition` runs during the plan). Approvals are stored in `~/.codify/approved-template-commands.json` keyed by a hash of the template sources and the full config. Declining throws `TemplateCommandsDeclinedError` (whole run stops). `-y` does not approve them; `--auto-approve-all` / `-yy` does. `Reporter.promptTemplateCommandApproval` must never auto approve (Json reporter throws, Stub declines).
+- `codify apply <template>` is a project with a single template declaration (the resolver's fetched template is seeded into the loader).
+- `import`/`refresh`/`edit` do not expand templates: template blocks are left untouched in files.
+
 ## Plugin Error Handling Architecture
 
 Plugin errors flow as structured `PluginErrorData` over IPC and are caught as `PluginError` instances on the CLI side:
 
@@ -5,7 +5,7 @@
   },
   "dependencies": {
     "@codifycli/ink-form": "0.0.12",
-    "@codifycli/schemas": "1.2.0",
+    "@codifycli/schemas": "1.3.0",
     "@homebridge/node-pty-prebuilt-multiarch": "npm:node-pty@1.2.0-beta.15",
     "@mischnic/json-sourcemap": "^0.1.1",
     "@oclif/core": "^4.0.8",
 
@@ -1,6 +1,7 @@
 import { Args, Flags } from '@oclif/core'
 import chalk from 'chalk';
 
+import { autoApproveAllFlag, isAutoApproveAll } from '../common/approval-flags.js';
 import { BaseCommand } from '../common/base-command.js';
 import { ApplyOrchestrator } from '../orchestrators/apply.js';
 
@@ -16,6 +17,9 @@ any changes.
 For scripts: use ${chalk.bold.bgMagenta(' --output json ')} which will skip approval and 
 apply changes directly.
 
+Commands (actions) that come from templates always have to be approved, even with -y.
+Use ${chalk.bold.bgMagenta(' -yy ')} or ${chalk.bold.bgMagenta(' --auto-approve-all ')} to approve them as well.
+
 The config can be a local file or directory, a public template name, or a Codify
 dashboard document id. With no argument, the codify file in the current directory is used.
 
@@ -33,6 +37,7 @@ For more information, visit: https://codifycli.com/docs/commands/apply
       char: 'y',
       default: false,
     }),
+    'auto-approve-all': autoApproveAllFlag,
     'verbose': Flags.boolean({
       char: 'v',
       description: 'Print plugin output (stdout/stderr) to the terminal.',
@@ -54,10 +59,11 @@ For more information, visit: https://codifycli.com/docs/commands/apply
     '<%= config.bin %> <%= command.id %> --path ~',
     '<%= config.bin %> <%= command.id %> -o json',
     '<%= config.bin %> <%= command.id %> -S <sudo password>',
+    '<%= config.bin %> <%= command.id %> -yy',
   ]
 
   public async run(): Promise<void> {
-    const { flags, args } = await this.parse(Apply)
+    const { flags, args, raw } = await this.parse(Apply)
 
     if (flags.path && args.pathArgs) {
       throw new Error('Cannot specify both --path and path argument');
@@ -67,6 +73,7 @@ For more information, visit: https://codifycli.com/docs/commands/apply
       path: flags.path ?? args.pathArgs,
       verbosityLevel: flags.debug || flags.verbose ? 3 : 0,
       autoApprove: flags.yes,
+      autoApproveAll: isAutoApproveAll(flags, raw),
       allowSleep: flags['allow-sleep'],
       // secure: flags.secure,
     }, this.reporter);
 
@@ -3,6 +3,7 @@ import chalk from 'chalk';
 
 import { BaseCommand } from '../common/base-command.js';
 import { DestroyOrchestrator } from '../orchestrators/destroy.js';
+import { autoApproveAllFlag, isAutoApproveAll } from '../common/approval-flags.js';
 
 export default class Destroy extends BaseCommand {
   static strict = false;
@@ -38,6 +39,7 @@ For more information, visit: https://codifycli.com/docs/commands/destory`
       char: 'y',
       default: false,
     }),
+    'auto-approve-all': autoApproveAllFlag,
     'verbose': Flags.boolean({
       char: 'v',
       description: 'Print plugin output (stdout/stderr) to the terminal.',
@@ -60,6 +62,7 @@ For more information, visit: https://codifycli.com/docs/commands/destory`
       typeIds: args,
       path: flags.path,
       autoApprove: flags.yes,
+      autoApproveAll: isAutoApproveAll(flags, raw),
       allowSleep: flags['allow-sleep'],
     }, this.reporter)
 
 
@@ -3,6 +3,8 @@ import { BaseCommand } from '../common/base-command.js';
 import { PlanOrchestrator } from '../orchestrators/plan.js';
 import { Args } from '@oclif/core';
 
+import { autoApproveAllFlag } from '../common/approval-flags.js';
+
 export default class Plan extends BaseCommand {
   static description =
 `Generate an execution plan to apply changes from a codify.jsonc file.
@@ -24,6 +26,10 @@ For more information, visit: https://codifycli.com/docs/commands/plan`
     '<%= config.bin %> <%= command.id %> <template name>',
   ]
 
+  static flags = {
+    'auto-approve-all': autoApproveAllFlag,
+  }
+
   static args = {
     pathArgs: Args.string({ description: 'Path to a codify file or directory, a template name, or a document id' }),
   }
@@ -42,7 +48,9 @@ For more information, visit: https://codifycli.com/docs/commands/plan`
     await PlanOrchestrator.run({
       verbosityLevel: flags.debug ? 3 : 0,
       path: flags.path ?? args.pathArgs,
-      secureMode: flags.secure,
+      // No --secure flag is declared on plan (kept as before)
+      secureMode: (flags as { secure?: boolean }).secure,
+      autoApproveTemplateCommands: flags['auto-approve-all'],
     }, this.reporter);
 
     process.exit(0);
 
@@ -0,0 +1,19 @@
+import { Flags } from '@oclif/core';
+
+/**
+ * --auto-approve-all (or -yy) approves everything, including commands that come from templates. A single -y never
+ * approves commands from templates.
+ */
+export const autoApproveAllFlag = Flags.boolean({
+  description: 'Approve everything without prompting, including commands (actions) that come from templates. Same as -yy. Only use this with templates you trust.',
+  default: false,
+});
+
+/** True if --auto-approve-all was passed or -y was passed twice (-yy or -y -y). */
+export function isAutoApproveAll(
+  flags: { 'auto-approve-all'?: boolean },
+  raw: Array<{ flag?: string; type: string }>,
+): boolean {
+  const yesCount = raw.filter((token) => token.type === 'flag' && token.flag === 'yes').length;
+  return Boolean(flags['auto-approve-all']) || yesCount >= 2;
+}
@@ -358,3 +358,29 @@ export class NoCodifyFilesError extends CodifyError {
     return `${this.message}\n\n${chalk.white(usage)}`;
   }
 }
+
+export class TemplateError extends CodifyError {
+  name = 'TemplateError'
+  templateSource: string;
+
+  constructor(templateSource: string, message: string) {
+    super(message);
+    this.templateSource = templateSource;
+  }
+
+  formattedMessage(): string {
+    return `Template error (${this.templateSource}): ${this.message}`;
+  }
+}
+
+export class TemplateCommandsDeclinedError extends CodifyError {
+  name = 'TemplateCommandsDeclinedError'
+
+  constructor() {
+    super('Commands from templates were not approved. Nothing was changed.');
+  }
+
+  formattedMessage(): string {
+    return this.message;
+  }
+}
@@ -1,11 +1,14 @@
 import { Config } from '@codifycli/schemas';
 
 import { Project } from '../entities/project.js';
+import { TemplateConfig } from '../entities/template-config.js';
 import { SubProcessName, ctx } from '../events/context.js';
 import { CodifyParser } from '../parser/index.js';
 import { CodifyResolver, type CodifySource, CodifySourceType } from '../parser/resolver.js';
 import { PluginManager, ResourceDefinitionMap } from '../plugins/plugin-manager.js';
 import { Reporter } from '../ui/reporters/reporter.js';
+import { templateExpander, templateLoader } from '../templates/template-expander.js';
+import { MergeWarning, TemplateResourceMerger } from '../templates/template-resource-merger.js';
 import { ShellUtils } from '../utils/shell.js';
 
 export interface InitializeArgs {
@@ -18,12 +21,16 @@ export interface InitializeArgs {
   codifyConfigs?: Config[];
   noProgress?: boolean;
   allowTemplates?: boolean;
+  // Expand template declarations into their resources (plan, apply and destroy)
+  expandTemplates?: boolean;
 }
 
 export interface InitializationResult {
   resourceDefinitions: ResourceDefinitionMap
   pluginManager: PluginManager,
   project: Project,
+  // Values that could not be merged when merging duplicate resources from templates
+  templateMergeWarnings: MergeWarning[],
 }
 
 export class PluginInitOrchestrator {
@@ -46,7 +53,13 @@ export class PluginInitOrchestrator {
     project.removeResourcesUsingOsFilter();
     await project.removeResourcesUsingDistroFilter();
 
-    return { resourceDefinitions, pluginManager, project };
+    // Merging duplicates asks the plugins (match), so it runs after plugin initialization and after the os/distro
+    // filters so that resources that don't apply to this machine are not merged.
+    const templateMergeWarnings = project.templatesExpanded
+      ? await TemplateResourceMerger.merge(project, pluginManager, resourceDefinitions)
+      : [];
+
+    return { resourceDefinitions, pluginManager, project, templateMergeWarnings };
   }
 
   private static async parseProject(
@@ -58,7 +71,12 @@ export class PluginInitOrchestrator {
     }
 
     if (args.codifyConfigs) {
-      return CodifyParser.parseJson(args.codifyConfigs);
+      const project = await CodifyParser.parseJson(args.codifyConfigs);
+      if (args.expandTemplates) {
+        await templateExpander.expand(project);
+      }
+
+      return project;
     }
 
     const source = await CodifyResolver.resolve({
@@ -70,6 +88,9 @@ export class PluginInitOrchestrator {
     ctx.subprocessStarted(SubProcessName.PARSE);
     const project = await PluginInitOrchestrator.parseSource(source);
     project.source = source;
+    if (args.expandTemplates) {
+      await templateExpander.expand(project);
+    }
     ctx.subprocessFinished(SubProcessName.PARSE);
 
     if (args.transformProject) {
@@ -90,7 +111,10 @@ export class PluginInitOrchestrator {
       }
 
       case CodifySourceType.TEMPLATE: {
-        return CodifyParser.parseTemplate(source.template);
+        // `codify apply <template>` is a project with a single template declaration. The template was already fetched
+        // by the resolver.
+        templateLoader.seed(source.location, source.template);
+        return Project.create([new TemplateConfig({ type: 'template', source: source.location })], []);
       }
 
       default: {
 
@@ -1,6 +1,7 @@
 export enum ConfigType {
   PROJECT = 'project',
   RESOURCE = 'resource',
+  TEMPLATE = 'template',
 }
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,7 @@`
`1`	`1`	`export enum ConfigType {`
`2`	`2`	`PROJECT = 'project',`
`3`	`3`	`RESOURCE = 'resource',`
	`4`	`+ TEMPLATE = 'template',`
`4`	`5`	`}`
`5`	`6`
`6`	`7`